CVE-2026-70556 Details

A cross-site request forgery (CSRF) vulnerability has been identified in Hubzilla version 11.2.1. The issue resides in the OAuth2 authorization endpoint, specifically within the 'Zotlabs\Module\Authorize::post()' method. This vulnerability allows unauthenticated attackers to register arbitrary OAuth2 applications under the accounts of authenticated users. Exploitation involves sending a cross-origin POST request that omits the required CSRF token and bypasses Origin/Referer validation. Attackers can create a malicious HTML form that automatically submits selected OAuth2 parameters—such as client_id, client_secret, redirect_uri, and scope—to covertly register a persistent OAuth2 application. This registered application can then intercept future OAuth2 authorization codes when the user authenticates with the attacker-controlled client.

Users can update to Hubzilla version 11.2.2 or later, where this vulnerability has been patched.